sri-test.biz

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The description tells the agent to 'GET https://sri-test.biz/v1/corpus' directly, outside the tool's own invocation path. This is an instruction embedded in a tool description that steers the agent toward making a raw HTTP request to a third-party domain that isn't verified as an official registry endpoint. An agent following this literally could leak query context or be redirected to attacker-controlled infrastructure. The domain name ('sri-test.biz') doesn't match any known official registry and looks disposable/test-like, which is a red flag for spoofing a legitimate coverage index.

The 'l402_token' field description states 'Payment, when charged, is over x402 (USDC on Base) via HTTP 402.' This reveals the tool can silently escalate into a paid, on-chain transaction flow triggered by an HTTP 402 response, without the schema exposing any explicit confirmation step. An agent calling this tool for what looks like a free lookup could inadvertently initiate a crypto payment on the user's behalf. This capability (moving funds) is far broader than the tool's stated purpose of read-only source analysis and should require explicit user approval before any payment path is exercised.